Automated Methods for Checking Differential Privacy

by   Gilles Barthe, et al.

Differential privacy is a de facto standard for statistical computations over databases that contain private data. The strength of differential privacy lies in a rigorous mathematical definition that guarantees individual privacy and yet allows for accurate statistical results. Thanks to its mathematical definition, differential privacy is also a natural target for formal analysis. A broad line of work uses logical methods for proving privacy. However, these methods are not complete, and only partially automated. A recent and complementary line of work uses statistical methods for finding privacy violations. However, the methods only provide statistical guarantees (but no proofs). We propose the first decision procedure for checking the differential privacy of a non-trivial class of probabilistic computations. Our procedure takes as input a program P parametrized by a privacy budget ϵ, and either proves differential privacy for all possible values of ϵ or generates a counterexample. In addition, our procedure applies both to ϵ-differential privacy and (ϵ,δ)-differential privacy. Technically, the decision procedure is based on a novel and judicious encoding of the semantics of programs in our class into a decidable fragment of the first-order theory of the reals with exponentiation. We implement our procedure and use it for (dis)proving privacy bounds for many well-known examples, including randomized response, histogram, report noisy max and sparse vector.


page 1

page 2

page 3

page 4


Deciding Accuracy of Differential Privacy Schemes

Differential privacy is a mathematical framework for developing statisti...

Synthesizing Coupling Proofs of Differential Privacy

Differential privacy has emerged as a promising probabilistic formulatio...

Proving Differential Privacy with Shadow Execution

Recent work on formal verification of differential privacy shows a trend...

Multivariate Mean Comparison under Differential Privacy

The comparison of multivariate population means is a central task of sta...

A unified view on differential privacy and robustness to adversarial examples

This short note highlights some links between two lines of research with...

Toward Detecting Violations of Differential Privacy

The widespread acceptance of differential privacy has led to the publica...

Bayesian and Frequentist Semantics for Common Variations of Differential Privacy: Applications to the 2020 Census

The purpose of this paper is to guide interpretation of the semantic pri...

Please sign up or login with your details

Forgot password? Click here to reset